IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 contain an integer overflow or wraparound vulnerability (CWE-190) in the host firmware. This flaw allows an attacker with service processor access to supply a specially crafted command that could leak hardware register contents normally inaccessible to the service processor. The vulnerability could cause limited confidentiality breaches and availability issues on the host system. The CVSS 3.1 vector is AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H, reflecting local attack vector, low complexity, high privileges required, no user interaction, scope changed, limited confidentiality impact, no integrity impact, and high availability impact. There are no known exploits in the wild and no patch or remediation details provided.

Successful exploitation may lead to limited confidentiality loss by leaking hardware register contents and could cause availability impacts on the affected IBM Power Systems host. The integrity of the system is not impacted. The attack requires high privileges (service access to the service processor) and local access. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict and monitor access to the service processor to trusted administrators only to reduce risk.